Product Documentation
ADC
14.1 - Current Release 13.1 13.0 12.1
View PDF

TCP Configurations

September 30, 2024
Contributed by: 
C C

TCP configurations for a NetScaler appliance can be specified in an entity called a TCP profile, which is a collection of TCP settings. The TCP profile can then be associated with services or virtual servers that want to use these TCP configurations.

A default TCP profile can be configured to set the TCP configurations that will be applied by default, globally to all services and virtual servers.

Note:

When a TCP parameter has different values for service, virtual server, and globally, the value of the most-specific entity (the service) is given the highest precedence. The NetScaler appliance also provides other approaches for configuring TCP.

Supported TCP configuration

The NetScaler appliance supports the following TCP capabilities:

Defending TCP against spoofing attacks as per RFC 5961

NetScaler supports RST window attenuation and SYN spoof protection methods to defend TCP against spoofing attacks and is compliant with RFC 4953.

Starting from NetScaler 14.1-4.x release, NetScaler is compliant with RFC 5961 which provides improved protection against TCP spoofing attacks. With RFC 5961 compliance, NetScaler provides the following capabilities in addition to RST window attenuation and SYN spoof protection:

  • Reduces the probability of invalid data injection.
  • Allows imposing a limit on the number of challenge ACK responses per second sent by the NetScaler.

By default, RFC 5961 compliance is disabled. You can enable it by using the CLI or the GUI. For more information, see Defending TCP against spoofing attacks.

Explicit Congestion Notification (ECN)

The appliance sends notification of the network congestion status to the sender of the data and takes corrective measures for data congestion or data corruption. The NetScaler implementation of ECN is RFC 3168 compliant.

Round trip time measurement (RTTM) using the timestamp option

For the TimeStamp option to work, at least one side of the connection (client or server) must support it. The NetScaler implementation of the TimeStamp option is RFC 1323 compliant.

Detection of spurious retransmissions

This detection can be done using TCP duplicate selective acknowledgment (D-SACK) and forward RTO-Recovery (F-RTO). If there are spurious retransmissions, the congestion control configurations are reverted to their original state. The NetScaler implementation of D-SACK is RFC 2883 compliant, and F-RTO is RFC 5682 compliant.

Congestion control

This functionality use New-Reno, BIC, CUBIC, Nile, TCP Westwood, and BBR algorithms.

  • BBR: Operates by monitoring the round-trip time (RTT) and bandwidth rather than reacting to packet loss. This approach allows BBR to regulate traffic effectively that results in improved throughput and latency.
  • BIC: Optimized for high speed networks with high latency (long fat networks). For these networks, BIC has a significant advantage over other congestion control algorithms in correcting severely under-utilized bandwidth.
  • CUBIC: Achieves high bandwidth connections over networks more quickly and reliably during high latency. It helps to optimize long fat networks.
  • Default/New Reno - Prevents too many packet losses due to congestion, and maintains fairness with other flows.
  • Nile: NetScaler has developed this TCP optimization algorithm for high-speed networks such as LTE, LTE advanced, and 3G. Nile addresses unique challenges caused by fading, random or congestive losses, link layer retransmissions, and carrier aggregation. For more information, see NILE algorithm. For more information, see NILE algorithm.
  • Westwood: TCP Westwood (TCPW) algorithm is a sender-side modification of the TCP congestion window algorithm that improves the performance in both wired and wireless networks.

Configure BBR algorithm:

Starting from NetScaler release 14.1-21.x, NetScaler supports the Bottleneck Bandwidth and Round-trip propagation time (BBR) algorithm for TCP. While using this algorithm, NetScaler provides an enhanced network performance and a more efficient traffic management system.

To configure BBR support using the CLI, run the following command:

set ns tcpprofile <tcpprofile> -SACK [enable|disable] -flavor [ BBR| BIC |  CUBIC | Default | Nile | Westwood ]
<!--NeedCopy-->

Note:

For optimal functionality of the BBR congestion control algorithm, the Selective Acknowledgment (SACK) feature must be enabled on the TCP profile.

Example:

set ns tcpprofile <tcpprofilename> -SACK enable -flavor BBR
<!--NeedCopy-->

To configure BBR support using the GUI:

  1. Navigate to System > Profiles > TCP profiles and click Add.
  2. In the Create TCP Profile page, for the TCP Flavor field, select BBR.

Window scaling

This increases the TCP receive window size beyond its maximum value of 65,535 bytes.

Points to consider before you configure window scaling

  • You do not set a high value for the scale factor, because this might have adverse effects on the appliance and the network.
  • You do not configure window scaling unless you clearly know why you want to change the window size.
  • Both hosts in the TCP connection send a window scale option during connection establishment. If only one side of a connection sets this option, window scaling is not used for the connection.
  • Each connection for the same session is an independent window scaling session. For example, when a client’s request and the server’s response flow through the appliance, it is possible to have window scaling between the client and the appliance without window scaling between the appliance and the server.

TCP maximum congestion window

The window size is a user configurable one. The default value is 8190 bytes.

Selective acknowledgment (SACK)

This uses the data receiver (either a NetScaler appliance or a client) notifies the sender about all the segments that have been received successfully.

Forward acknowledgment (FACK)

This functionality avoids TCP congestion by explicitly measuring the total number of data bytes outstanding in the network, and helping the sender (either a NetScaler or a client) control the amount of data injected into the network during retransmission timeouts.

TCP connection multiplexing

This functionality enables reuse of existing TCP connections. The NetScaler appliance stores established TCP connections to the reuse pool. Whenever a client request is received, the appliance checks for an available connection in the reuse pool and serves the new client if the connection is available. If it is unavailable, the appliance creates a connection for the client request and stores the connection to the reuse pool. The NetScaler supports connection multiplexing for HTTP, SSL, and DataStream connection types.

Dynamic receive buffering

This allows the receive buffer to be adjusted dynamically based on memory and network conditions.

MPTCP Connection

MPTCP connections between the client and the NetScaler. MPTCP connections are not supported between the NetScaler and the back-end server. The NetScaler implementation of MPTCP is RFC 6824 compliant.

You can view MPTCP statistics such as active MPTCP connections and active subflow connections by using the command line interface.

At the command prompt, type one of the following commands to display a summary or detailed summary of MPTCP statistics, or to clear the statistics display:

  1. Stat MPTCP
  2. Stat mptcp –detail
  3. Clearstats basic

Note:

To establish an MPTCP connection, both the client and the NetScaler appliance must support the same MPTCP version. If you use the NetScaler appliance as an MPTCP gateway for your servers, the servers do not have to support MPTCP. When the client starts a new MPTCP connection, the appliance identifies the client’s MPTPC version from the MP_CAPABALE option in the SYN packet. If the client’s version is higher than the one supported on the appliance, the appliance indicates its highest version in the MP_CAPABALE option of the SYN-ACK packet. The client then falls back to a lower version and sends the version number in the MP_CAPABALE option of the ACK packet. If that version is supportable, the appliance continues the MPTCP connection. Otherwise, the appliance falls back to a regular TCP. The NetScaler appliance does not initiate subflows (MP_JOIN’s). The appliance expects the client to initiate subflows.

Support for additional address advertisement (ADD_ADDR) in MPTCP

In an MPTCP deployment, if you have a virtual server bound with an IP set that has additional virtual server IP addresses, then the additional address advertisement (ADD_ADDR) functionality advertises the IP address of the virtual servers bound to the IP set. Clients can initiate additional MP-JOIN sub flows to the advertised IP addresses.

Points to remember about MPTCP ADD_ADDR functionality

  • You can send a maximum of 10 IP addresses as part of the ADD_ADDR option. If there are more than 10 IP addresses with the mptcpAdvertise parameter enabled, after advertising the 10 IP address, the appliance ignore the rest of the IP addresses.
  • If the MP-CAPABLE subflow is made to one of the IP addresses in the IP set instead of the primary virtual server IP address, then the virtual server IP address is advertised if the mptcpAdvertise parameter is enabled for the virtual server IP address

Configure more address advertisement (ADD_ADDR) feature to advertise additional VIP address by using the CLI

You can configure the MPTCP ADD_ADDR functionality for both IPv4 and IPv6 address types. In general, multiple IPv4 and IPv6 IPs can be attached to a single IP set and the parameter can be enabled on any subset of IP addresses. In the ADD_ADDR feature, only the IP addresses that have the “mptcpAdvertise” option enabled is advertised and the remaining IP addresses from the IP set is ignored. Complete the following steps to configure the ADD_ADDR feature:

  1. Add an IP set.
  2. Add an IP address of type virtual server IP (VIP) with MPTCP advertise enabled.
  3. Bind the IP address with the IP set.
  4. Configure the IP set with the load balancing virtual server.

Add an IP set

At the command prompt, type:

add ipset <name> [-td <positive_integer>]
<!--NeedCopy-->

Example:

add ipset ipset_1
<!--NeedCopy-->

Add an IP address of type virtual server IP (VIP) with MPTCP advertise enabled

At the command type:

add ns ip <IPAddress>@ <netmask> [-mptcpAdvertise ( YES | NO )] -type <type>
<!--NeedCopy-->

Example:

add ns ip 10.10.10.10 255.255.255.255 -mptcpAdvertise YES -type VIP

Bind IP addresses to the IP set

At the command prompt, type:

bind ipset <name> <IPAddress>
<!--NeedCopy-->

Example:

bind ipset ipset_1 10.10.10.10

Configure IP set to load balancing virtual server

At the command prompt, type:

set lb vserver <name> [-ipset  <string>]
<!--NeedCopy-->

Example:

set lb vserver lb1 -ipset ipset_1
<!--NeedCopy-->

Sample Configuration:

Add ipset ipset_1
add ns ip 10.10.10.10 255.255.255.255 -mptcpAdvertise YES -type VIP
bind ipset ipset_1 10.10.10.10
set lb vserver lb1 -ipset ipset_1
<!--NeedCopy-->

Configure advertising external IP address using ADD_ADDR functionality

If the advertised IP address is owned by the external entity and the NetScaler appliance needs to advertise the IP address, the “MPTCPAdvertise” parameter must be enabled with state and ARP parameters disabled.

Complete the following steps to configure ADD_ADDR for advertising the external IP address.

  1. Add an IP address of type virtual server IP (VIP) with MPTCP advertise enabled.
  2. Bind the IP address with the IP set.
  3. Bind IP set with the load balancing virtual server

Add an external IP address of type virtual server IP (VIP) with MPTCP advertise enabled

At the command prompt, type:

add ns ip <IPAddress>@ <External-IP-mask -type VIP> [-mptcpAdvertise ( YES | NO )] -type <type> -state DISABLED -arp DISABLED
<!--NeedCopy-->

Example:

add ns ip 10.10.10.10 255.255.255.255 -mptcpAdvertise YES -type VIP -state DISABLED -arp DISABLED

Bind IP addresses to the IP set

At the command prompt, type:

bind ipset <name> <IPAddress>
<!--NeedCopy-->

Example:

bind ipset ipset_1 10.10.10.10

Configure IP set to load balancing virtual server

At the command prompt, type:

set lb vserver <name> [-ipset  <string>]
<!--NeedCopy-->

Example:

set lb vserver lb1 -ipset ipset_1

Sample Configuration:

add ns ip 10.10.10.10 255.255.255.255 -mptcpAdvertise YES -type VIP state DISABLED -arp DISABLED
bind ipset ipset_1 10.10.10.10
set lb vserver lb1 -ipset ipset_1
<!--NeedCopy-->

Complete the following step to advertise the IP address to the MPTCP enabled clients:

  1. Navigate to System > Network > IPs.
  2. In the details pane, click Add.
  3. In the Create IP Address page, select the MPTCP Advertise check box to set the parameter. By default, it is disabled.

Extracting the TCP/IP path overlay option and inserting the client-IP HTTP header

Extracting TCP/IP path overlay and inserting client-IP HTTP header. Data transport through overlay networks often uses connection termination or Network Address Translation (NAT), in which the IP address of the source client is lost. To avoid this, the NetScaler appliance extracts the TCP/IP path overlay option and inserts the source client’s IP address into the HTTP header. With the IP address in the header, the web server can identify the source client that made the connection. The extracted data is valid for a lifetime of the TCP connection and therefore, this prevents the next hop host from having to interpret the option again. This option is applicable only for web services that have the client-IP insertion option enabled.

TCP segmentation offload

Offloads TCP segmentation to the NIC. If you set the option as “AUTOMATIC”, TCP segmentation is offloaded to the NIC, if NIC is supported.

This is used for resisting SYN flood attacks. You can enable or disable the SYNCOOKIE mechanism for TCP handshake with clients. Disabling SYNCOOKIE prevents SYN attack protection on the NetScaler appliance.

Learning MSS to enable MSS learning for all the virtual servers configured on the appliance

Supported TCP Parameters

The following table provides a list of TCP parameters and their default values:

Parameter Default Value Description
Window Management    
TCP Delayed-ACK Timer 100 millisec Timeout for TCP delayed ACK, in milliseconds.
TCP minimum Retransmission Timeout(RTO) in milli sec 1000 milli sec Minimum retransmission timeout, in milliseconds, specified in 10-millisecond increments (value must yield a whole number if divided by 10)
Connection idle time before starting keep-alive probes 900 seconds Silently drop TCP established connections on idle timeouts established connections on idle timeout
TCP Timestamp Option DISABLED The timestamp option allows for accurate RTT measurement. Enable or Disable TCP Timestamp option.
Multipath TCP session timeout 0 seconds MPTCP session timeout in seconds. If this value is not set, idle. MPTCP sessions are flushed after the virtual server’s client idle timeout.
Silently Drop HalfClosed connections on idle timeout 0 seconds Silently drop TCP half closed connections on idle timeout.
Silently Drop Established connections on idle timeout DISABLED Silently drop TCP established connections on idle timeout
Memory Management    
TCP Buffer Size
131072 bytes
TCP buffer size is the receive buffer size on the NetScaler. This buffer size is advertised to clients and servers from NetScaler and it controls their ability to send data to NetScaler. The default buffer size is 131072 and usually it is safe to increment this when talking to internal server farms. The buffer size is also impacted by the actual application layer in NetScaler. For SSL endpoint cases, the buffer size is set to 40 K and for Compression, it is set to 96 K.
Note: The buffer size argument must be set for dynamic adjustments to take place.
TCP Send Buffer Size 131072 bytes TCP Send Buffer Size
TCP Dynamic Receive Buffering DISABLED Enable or disable dynamic receive buffering. When enabled, it allows the receive buffer to be adjusted dynamically based on memory and network conditions. Note: The buffer size argument must be set for dynamic adjustments to take place
TCP Max congestion window(CWND) 524288 bytes TCP Maximum Congestion Window
Window Scaling status ENABLED Enable or disable window scaling.
Window Scaling factor 8 Factor used to calculate the new window size. This argument is needed only when window scaling is enabled.
Connection Setup    
Keep-alive probes DISABLED Send periodic TCP keep-alive (KA) probes to check if peer is still up.
Connection idle time before starting keep-alive probes 900 seconds Duration, in seconds, for the connection to be idle, before sending a keep-alive (KA) probe.
Keep-alive probe interval 75 seconds Time interval, in seconds, before the next keep-alive (KA) probe, if the peer does not respond.
Maximum keep-alive probes to be missed before dropping connection. 3 Number of keep-alive (KA) probes to be sent when not acknowledged, before assuming the peer to be down.
RFC 5961 compliance DISABLED Enable RFC 5961 compliance to protect against spoofing. When enabled, provides both RST window attenuation and SYN spoof protection and also allows you to control the number of challenge ACK sent by the NetScaler. For RFC 5961 compliance feature to work, you must disable both RST window attenuation and SYN spoof protection.
RST window attenuation (spoof protection). DISABLED Enable or disable RST window attenuation to protect against spoofing. When enabled, the reply is with corrective ACK when a sequence number is invalid.
Accept RST with last acknowledged sequence number. ENABLED  
Data transfer    
Immediate ACK on PUSH packet ENABLED Send immediate positive acknowledgment (ACK) on receipt of TCP packets with PUSH flag.
Maximum packets per MSS 0 Maximum number of octets to allow in a TCP data segment
Nagle’s Algorithm DISABLED Nagle’s Algorithm fights with the problem of small packets in TCP transmission. Applications like Telnet and other real time engines which require every key stroke to be passed to the other side often create small packets. With Nagle’s algorithm NetScaler can buffer such small packets and sends them together to increase on the connection efficiency. This algorithm needs to work along with other TCP optimization techniques in the NetScaler.
Maximum TCP segments allowed in a burst 10 MSS Maximum number of TCP segments allowed in a burst
Maximum out-of-order packets to queue 300 Maximum size of out-of-order packets queue. A value of 0 means no limit
Congestion Control    
TCP Flavor CUBIC  
Initial congestion window(cwnd) setting 4 MSS Initial maximum upper limit on the number of TCP packets that can be outstanding on the TCP link to the server
TCP Explicit Congestion Notification(ECN) DISABLED Explicit Congestion Notification (ECN) provides end to end notification of network congestion without dropping packets.
TCP Max congestion window(CWND) 524288 bytes TCP maintains a congestion window (CWND), limiting the total number of unacknowledged packets that may be in transit end-to-end. In TCP, the congestion window is one of the factors that determines the number of bytes that can be outstanding at any time. The congestion window is a means of stopping a link between the sender and the receiver from becoming overloaded with too much traffic. It is calculated by estimating how much congestion there is on the link.
TCP Hybrid Start (HyStart) 8 bytes  
TCP minimum Retransmission Timeout(RTO) in milli sec 1000 Minimum retransmission timeout, in milliseconds, specified in 10-millisecond increments (value must yield a whole number if divided by 10).
TCP dupack threshold DISABLED  
Burst Rate Control 3 TCP Burst Rate Control DISABLED/FIXED/DYNAMIC. FIXED requires a TCP rate to be set
TCP Rate DISABLED TCP connection payload send rate in Kb/s
TCP Rate Maximum Queue 0 Maximum connection queue size in bytes, when BurstRateControl is used.
MPTCP    
Multipath TCP DISABLED Multipath TCP (MPTCP) is a set of extensions to regular TCP to provide a Multipath TCP service, which enables a transport connection to operate across multiple paths simultaneously.
Multipath TCP drop data on pre-established subflow DISABLED Enable or disable silently dropping the data on Pre-Established subflow. When enabled, DSS data packets are dropped silently instead of dropping the connection when data is received on pre established subflow.
Multipath TCP fastopen DISABLED Enable or disable Multipath TCP fastopen. When enabled, DSS data packets are accepted before receiving the third ack of SYN handshake.
Multipath TCP session timeout 0 seconds MPTCP session timeout in seconds. If this value is not set, idle MPTCP sessions are flushed after the virtual server’s client idle timeout.
Security    
SYN spoof protection DISABLED Enable or disable the drop of invalid SYN packets to protect against spoofing. When disabled, established connections are reset when a SYN packet is received.
TCP Syncookie DISABLED This is used for resisting SYN flood attacks. Enable or disable the SYNCOOKIE mechanism for TCP handshake with clients. Disabling SYNCOOKIE prevents SYN attack protection on the NetScaler appliance.
Loss Detection and Recovery    
Duplicate Selective Acknowledgment (DSACK) ENABLED A NetScaler appliance uses Duplicate Selective Acknowledgment (DSACK) to determine if a retransmission was sent in error.
Forward RTO recovery (FRTO) ENABLED Detects spurious TCP retransmission timeouts. After retransmitting the first unacknowledged segment triggered by a timeout, the algorithm of the TCP sender monitors the incoming acknowledgments to determine whether the timeout was spurious. It then decides whether to send new segments or retransmit unacknowledged segments. The algorithm effectively helps to avoid another unnecessary retransmissions and thereby improves TCP performance in the case of a spurious timeout.
TCP Forward Acknowledgment (FACK) ENABLED Enable or disable FACK (Forward ACK).
Selective Acknowledgement(SACK) status ENABLED TCP SACK addresses the problem of multiple packet losses which reduces the overall throughput capacity. With selective acknowledgment the receiver can inform the sender about all the segments which are received successfully, enabling the sender to only retransmit the segments which were lost. This technique helps NetScaler improve overall throughput and reduce the connection latency.
Maximum packets per retransmission 1 Allows NetScaler to control how many packets to be retransmitted in one attempt. When NetScaler receives a partial ACK and it has to do retransmission then this setting is considered. This does not impact the RTO-based retransmissions.
TCP Delayed-ACK Timer 100 millisec Timeout for TCP delayed ACK, in milliseconds
TCO Optimization    
TCP Optimization mode TRANSPARENT TCP Optimization modes TRANSPARENT/ENDPOINT
Apply adaptive TCP optimizations DISABLED Apply Adaptive TCP optimizations
TCP Segmentation Offload AUTOMATIC Offload TCP segmentation to the NIC. If set to AUTOMATIC, TCP segmentation is offloaded to the NIC, if the NIC supports it.
ACK Aggregation DISABLED Enable or disable ACK Aggregation
TCP Time-wait(or Time_wait) 40 secs Time to elapse before releasing a closed TCP connection
Delink client and server on RST DISABLED Delink client and server connection, when there is outstanding data to be sent to the other side.

Note:

When HTTP/2 is enabled, Citrix recommends you to disable TCP Dynamic Receive Buffering parameter in the TCP profile.

Setting Global TCP Parameters

The NetScaler appliance allows you to specify values for TCP parameters that are applicable to all NetScaler services and virtual servers. This can be done using:

  • Default TCP profile
  • Global TCP command
  • TCP buffering feature

Notes:

  • The recvBuffSize parameter of the set ns tcpParam command is deprecated from release 9.2 onwards. In later releases, set the buffer size by using the bufferSize parameter of the set ns tcpProfile command. If you upgrade to a release where the recvBuffSize parameter is deprecated, the bufferSize parameter is set to its default value.

  • While configuring TCP profile, ensure that the TCP buffersize parameter is lesser or equal to the httppipelinebuffersize parameter. If the buffersize parameter in TCP profile is greater than the httppipelinebuffersize parameter in HTTP profile, the TCP payload might get accumulated and exceed the HTTP pipeline buffer size. This results in NetScaler appliance resetting the TCP connection.

Default TCP profile

A TCP profile, named as nstcp_default_profile, is used to specify TCP configurations that are used if no TCP configurations are provided at the service or virtual server level.

Notes:

  • Not all TCP parameters can be configured through the default TCP profile. Some settings have to be performed by using the global TCP command (see section below).

  • The default profile does not have to be explicitly bound to a service or virtual server.

To configure the default TCP profile

  • Using the command line interface, at the command prompt enter:

     set ns tcpProfile nstcp_default_profile...
 <!--NeedCopy-->

  • On the GUI, navigate to System > Profiles, click TCP Profiles and update nstcp_default_profile.

Global TCP command

Another approach you can use to configure global TCP parameters is the global TCP command. In addition to some unique parameters, this command duplicates some parameters that can be set by using a TCP profile. Any update made to these duplicate parameters is reflected in the corresponding parameter in the default TCP profile.

For example, if the SACK parameter is updated using this approach, the value is reflected in the SACK parameter of the default TCP profile (nstcp_default_profile).

Note:

Citrix recommends that you use this approach only for TCP parameters that are not available in the default TCP profile.

To configure the global TCP command

  • Using the command line interface, at the command prompt enter:

     set ns tcpParam …
 <!--NeedCopy-->

  • On the GUI, navigate to System > Settings, click Change TCP parameters and, update the required TCP parameters.

TCP buffering feature

NetScaler provides a feature called TCP buffering that you can use to specify the TCP buffer size. The feature can be enabled globally or at service level.

Note:

The buffer size can also be configured in the default TCP profile. If the buffer size has different values in the TCP buffering feature and the default TCP profile, the greater value is applied.

Configure the TCP buffering feature globally

  • At the command prompt enter:

    enable ns mode TCPB

    set ns tcpbufParam -size <positiveInteger> -memLimit <positiveInteger>

  • On the GUI, navigate to System > Settings, click Configure Modes and, select TCP Buffering.

    And, navigate to System > Settings, click Change TCP parameters, specify values for Buffer size and Memory usage limit.

Setting Service or Virtual Server Specific TCP Parameters

Using TCP profiles, you can specify TCP parameters for services and virtual servers. You must define a TCP profile (or use a built-in TCP profile) and associate the profile with the appropriate service and virtual server.

Note:

You can also modify the TCP parameters of default profiles as per your requirements.

You can specify the TCP buffer size at service level using the parameters specified by the TCP buffering feature.

To specify service or virtual server level TCP configurations by using the command line interface

At the command prompt, perform the following:

  1. Configure the TCP profile.

    set ns tcpProfile <profile-name>...
<!--NeedCopy-->

  2. Bind the TCP profile to the service or virtual server.

   set service <name> ....
   <!--NeedCopy-->

Example:

> set service service1 -tcpProfileName profile1

To bind the TCP profile to the virtual server:

set lb vserver <name> ....
<!--NeedCopy-->

Example:

> set lb vserver lbvserver1 -tcpProfileName profile1
<!--NeedCopy-->

To specify service or virtual server level TCP configurations by using the GUI

At the GUI, perform the following:

  1. Configure the TCP profile.

    Navigate to System > Profiles > TCP Profiles, and create the TCP profile.

  2. Bind the TCP profile to the service or virtual server.

    Navigate to Traffic Management > Load Balancing > Services/Virtual Servers, and create the TCP profile, which should be bound to the service or virtual server.

Built-in TCP Profiles

For convenience of configuration, the NetScaler provides some built-in TCP profiles. Review the built-in profiles listed for the following and select a profile and use it as it is or modify it to meet your requirements. You can bind these profiles to your required services or virtual servers.

Built-in profile Description
nstcp_default_profile Represents the default global TCP settings on the appliance.
nstcp_default_tcp_lan Useful for back-end server connections, where these servers reside on the same LAN as the appliance.
nstcp_default_WAN useful for WAN deployments.
nstcp_default_tcp_lan_thin_stream Similar to the nstcp_default_tcp_lan profile. However, the settings are tuned to small size packet flows.
nstcp_default_tcp_interactive_stream Similar to the nstcp_default_tcp_lan profile. However, it has a reduced delayed ACK timer and ACK on PUSH packet settings.
nstcp_default_tcp_lfp Useful for long fat pipe networks (WAN) on the client side. Long fat pipe networks have long delay, high bandwidth lines with minimal packet drops.
nstcp_default_tcp_lfp_thin_stream Similar to the nstcp_default_tcp_lfp profile. However, the settings are tuned for small size packet flows.
nstcp_default_tcp_lnp Useful for long narrow pipe networks (WAN) on the client side. Long narrow pipe networks have considerable packet loss occasionally.
nstcp_default_tcp_lnp_thin_stream Similar to the nstcp_default_tcp_lnp profile. However, the settings are tuned for small size packet flows.
nstcp_internal_apps Useful for internal applications on the appliance (for example, GSLB site syncing). This contains tuned window scaling and SACK options for the desired applications. This profile should not be bound to applications other than internal applications.
nstcp_default_Mobile_profile Useful for mobile devices.
nstcp_default_XA_XD_profile Useful for the Citrix Virtual Apps and Desktops deployment.

Sample TCP Configurations

Sample command line interface examples for configuring the following:

Defending TCP against spoofing attacks

Prior to RFC 5961 compliance support

To enable RST window attenuation and SYN spoof protection by using the CLI:

> set ns tcpProfile profile1 -rstWindowAttenuate ENABLED -spoofSynDrop ENABLED
    Done
 > set lb vserver lbvserver1 -tcpProfileName profile1
    Done
<!--NeedCopy-->

To enable RST window attenuation and SYN spoof protection by using the GUI:

  1. Navigate to System > Profiles > TCP Profiles, and click Add to create a TCP profile.
  2. Select the RST Window Attenuation and SYN Spoof Protection.
  3. Click Create.

From NetScaler release 14.1-4.x onwards with RFC 5961 compliance support

To enable RFC 5961 compliance by using the CLI:

> set ns tcpProfile profile1 -rstWindowAttenuate DISABLED -spoofSynDrop DISABLED -rfc5961Compliance ENABLED
    Done
> set lb vserver lbvserver1 -tcpProfileName profile1
    Done
<!--NeedCopy-->

To impose the limit on the number of challenge ACKs allowed per second, enable the rfc5961ChallengeAckLimit parameter:

> set ns tcpParam -rfc5961ChlgAckLimit 100
 Done
<!--NeedCopy-->

To enable RFC 5961 compliance by using the GUI:

  1. Navigate to System > Profiles > TCP Profiles, and click Add to create a TCP profile.
  2. Clear RST Window Attenuation and SYN Spoof Protection.
  3. Select RFC5961 Compliance and click Create.
  4. Navigate to the System > Settings > Change TCP Parameters.
  5. Enter a value in RFC5961 Chlg Ack Limit and click OK.

Explicit Congestion Notification (ECN)

Enable ECN on the required TCP profile.

    > set ns tcpProfile profile1 -ECN ENABLED
    Done
    > set lb vserver lbvserver1 -tcpProfileName profile1
    Done
<!--NeedCopy-->

Selective Acknowledgment (SACK)

Enable SACK on the required TCP profile.

    > set ns tcpProfile profile1 -SACK ENABLED
    Done
    > set lb vserver lbvserver1 -tcpProfileName profile1
    Done
<!--NeedCopy-->

Forward Acknowledgment (FACK)

Enable FACK on the required TCP profile.

> set ns tcpProfile profile1 -FACK ENABLED
> set lb vserver lbvserver1 -tcpProfileName profile1
<!--NeedCopy-->

Window Scaling (WS)

Enable window scaling and set the window scaling factor on the required TCP profile.

set ns tcpProfile profile1 –WS ENABLED –WSVal 9
Done
set lb vserver lbvserver1 -tcpProfileName profile1
Done
<!--NeedCopy-->

Maximum Segment Size (MSS)

Update the MSS related configurations.

> set ns tcpProfile profile1 –mss 1460 - maxPktPerMss 512
Done
> set lb vserver lbvserver1 -tcpProfileName profile1
Done
<!--NeedCopy-->

NetScaler to learn the MSS of a virtual server

Enable the NetScaler to learn the VSS and update other related configurations.

> set ns tcpParam -learnVsvrMSS ENABLED –mssLearnInterval 180 -mssLearnDelay 3600
Done
<!--NeedCopy-->

TCP keep-alive

Enable TCP keep-alive and update other related configurations.

> set ns tcpProfile profile1 –KA ENABLED –KaprobeUpdateLastactivity ENABLED -KAconnIdleTime 900 -KAmaxProbes 3 -KaprobeInterval 75 Done > set lb vserver lbvserver1 -tcpProfileName profile1 Done

Buffer size - using TCP profile

Specify the buffer size.

> set ns tcpProfile profile1 –bufferSize 8190 Done > set lb vserver lbvserver1 -tcpProfileName profile1 Done

Buffer size - using TCP buffering feature

Enable the TCP buffering feature (globally or for a service) and then specify the buffer size and the memory limit.

> enable ns feature TCPB Done > set ns tcpbufParam -size 64 -memLimit 64 Done

MPTCP

Enable MPTCP and then set the optional MPTCP configurations.

> set ns tcpProfile profile1 -mptcp ENABLED Done > set ns tcpProfile profile1 -mptcpDropDataOnPreEstSF ENABLED -mptcpFastOpen ENABLED -mptcpSessionTimeout 7200 Done > set ns tcpparam -mptcpConCloseOnPassiveSF ENABLED -mptcpChecksum ENABLED -mptcpSFtimeout 0 -mptcpSFReplaceTimeout 10 -mptcpMaxSF 4 -mptcpMaxPendingSF 4 -mptcpPendingJoinThreshold 0 -mptcpRTOsToSwitchSF 2 -mptcpUseBackupOnDSS ENABLED Done

Congestion control

Set the required TCP congestion control algorithm.

set ns tcpProfile profile1 -flavor Westwood Done > set lb vserver lbvserver1 -tcpProfileName profile1 Done

Dynamic receive buffering

Enable dynamic receive buffering on the required TCP profile.

> set ns tcpProfile profile1 -dynamicReceiveBuffering ENABLED Done > set lb vserver lbvserver1 -tcpProfileName profile1 Done

Support for TCP Fast Open (TFO) in Multipath TCP (MPTCP)

A NetScaler appliance now supports the TCP Fast Open (TFO) mechanism for establishing Multipath TCP (MPTCP) connections and speed up data transfers. The mechanism allows subflow data to be carried during the initial MPTCP connection handshake in SYN and SYN-ACK packets and also enables data to be consumed by the receiving node during the MPTCP connection establishment.

For more information, see TCP Fast Open topic.

A NetScaler appliance now enables you to configure a variable length TCP Fast Open (TFO) cookie of a minimum size of 4 bytes and a maximum size of 16 bytes in a TCP profile. By doing this, the appliance can respond with the configured TFO cookie size in the SYN-ACK packet to the client.

To configure the TCP Fast Open (TFO) cookie in a TCP profile by using the command line interface

At the command prompt, type:

set tcpProfile nstcp_default_profile -tcpFastOpenCookieSize <positive_integer>

Example

set tcpProfile nstcp_default_profile -tcpFastOpenCookieSize 8

To configure the TCP Fast Open (TFO) cookie in a TCP profile by using the GUI

  1. Navigate to Configuration > System > Profiles.
  2. In the details pane, go to TCP Profiles tab and select a TCP profile.
  3. In the Configure TCP Profile page, set the TCP Fast Open cookie size.
  4. Click OK and Done.

The TCPSyncookie parameter is enabled by default in TCP profiles to provide robust (RFC 4987) based protection against SYN Attacks. If you need to accommodate custom TCP clients that are not compatible with this protection but still want to ensure a fallback if there is attack, the synAttackDetection handles this for you by automatically activating the SYNCookie behavior internally for time determined by the autosyncookietimeout parameter.

To configure the maximum SYN ACK retransmission threshold by using the command line interface:

At the command prompt, type:

    set ns tcpparam [-maxSynAckRetx <positive_integer>]

    Set ns tcpparam [-maxSynAckRetx 150]
<!--NeedCopy-->

To configure auto SYN cookie timeout interval by using the command line interface

At the command prompt, type:

set ns tcpparam [-autosyncookietimeout <positive_integer>]

Set ns tcpparam [-autosyncookietimeout 90]

Enhanced ISN generation

When enabled, the parameter increases the variance of the initial sequence numbers (ISN) generated by NetScaler while establishing a TCP connection. This scenario is applicable only for TCP connections where NetScaler acts as the server. By default, the parameter is disabled.

To enable enhanced ISN generation using the CLI, run the following command:

set ns tcpparam -enhancedISNgeneration [ENABLED | DISABLED]
<!--NeedCopy-->

Example:

set ns tcpparam -enhancedISNgeneration ENABLED
<!--NeedCopy-->

To enable enhanced ISN generation using the GUI:

  1. Navigate to Configuration -> System -> Settings -> Change TCP Parameters.

  2. In the Configure TCP Parameters page, select Enhanced ISN Generation.

  3. Click OK.

When enabled, the parameter delinks client and server connection when there is outstanding data to be sent to the other side. By default, the parameter is disabled.

set ns tcpparam -delinkClientServerOnRST ENABLED
Done
<!--NeedCopy-->

Configure the slow start threshold parameter

You can use the slow start threshold slowStartthreshold parameter to configure the tcp-slowstartthreshold value for the Nile variant of the congestion control algorithm. The acceptable values for the parameter are min = 8190 and max = 524288. The default value is 524288. The TCP variant Nile, under the TCP profile is no more dependent on the maxcwnd parameter. You have to configure the slowStartthreshold parameter for the Nile variant.

At the command prompt type:

set tcpprofile nstcp_default_profile -slowstartthreshold 8190
Done

<!--NeedCopy-->
TCP Configurations
September 30, 2024
Contributed by: 
C C
September 30, 2024
Contributed by: 
C C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.